Southwest Community Health Center

Thieves broke in and stole several computers at two facilities of the covered entity (CE), Southwest Community Health Center. The computers contained unsecured electronic protected health information (ePHI) saved or cached to the local hard drives. The CE reported that approximately 6,000 individuals were affected by the breach, but after data mining was completed, the CE determined that 13,481 individuals could have been affected. The types of ePHI involved in the breach included demographic, financial, and clinical information. The CE provided breach notification to HHS, affected individuals (7,965 by individual letter and 5,516 by substitute notice), and the media. Following the breach, the CE improved physical security, revised policies, ended caching ePHI to local hard drives, encrypted all workstations and laptop computers, and implemented several other enhancements to its information systems environment. OCR obtained assurances that the CE implemented the corrective actions noted above.